Skip to content

Commit fe34d63

Browse files
nodejs-github-botUlisesGascon
nodejs-github-bot
authored and
UlisesGascon
committed
deps: update zlib to 1.2.13.1-motley-f5fd0ad
PR-URL: #49252 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
1 parent 88ba79b commit fe34d63

File tree

6 files changed

+142
-3
lines changed

6 files changed

+142
-3
lines changed

‎deps/zlib/BUILD.gn

+1
Original file line numberDiff line numberDiff line change
@@ -512,6 +512,7 @@ if (build_with_chromium) {
512512
}
513513

514514
deps = [
515+
":minizip",
515516
":zlib",
516517
"google:compression_utils",
517518
"google:zip",

‎deps/zlib/contrib/minizip/README.chromium

+3
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,6 @@ Local Modifications:
1515
- Add parsing of the 'Info-ZIP Unicode Path Extra Field' as described in
1616
https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT section 4.6.9.
1717
(see crrev.com/1002476)
18+
19+
- Check for overly long filename, comment, or extra field in
20+
zipOpenNewFileInZip4_64 (crbug.com/1470539).

‎deps/zlib/contrib/minizip/zip.c

+11
Original file line numberDiff line numberDiff line change
@@ -1083,6 +1083,17 @@ extern int ZEXPORT zipOpenNewFileInZip4_64 (zipFile file, const char* filename,
10831083
return ZIP_PARAMERROR;
10841084
#endif
10851085

1086+
// The filename and comment length must fit in 16 bits.
1087+
if ((filename!=NULL) && (strlen(filename)>0xffff))
1088+
return ZIP_PARAMERROR;
1089+
if ((comment!=NULL) && (strlen(comment)>0xffff))
1090+
return ZIP_PARAMERROR;
1091+
// The extra field length must fit in 16 bits. If the member also requires
1092+
// a Zip64 extra block, that will also need to fit within that 16-bit
1093+
// length, but that will be checked for later.
1094+
if ((size_extrafield_local>0xffff) || (size_extrafield_global>0xffff))
1095+
return ZIP_PARAMERROR;
1096+
10861097
zi = (zip64_internal*)file;
10871098

10881099
if (zi->in_opened_file_inzip == 1)

‎deps/zlib/contrib/tests/DEPS

+1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
include_rules = [
22
"+testing/gtest",
3+
"+third_party/zlib/contrib/minizip",
34
"+base",
45
]

‎deps/zlib/contrib/tests/utils_unittest.cc

+123
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,12 @@
77
#include <cstddef>
88
#include <vector>
99

10+
#include "base/files/file_path.h"
11+
#include "base/files/scoped_temp_dir.h"
1012
#include "compression_utils_portable.h"
1113
#include "gtest.h"
14+
#include "third_party/zlib/contrib/minizip/unzip.h"
15+
#include "third_party/zlib/contrib/minizip/zip.h"
1216
#include "zlib.h"
1317

1418
void TestPayloads(size_t input_size, zlib_internal::WrapperType type) {
@@ -1015,3 +1019,122 @@ TEST(ZlibTest, DeflateZFixedCorruption) {
10151019
memcmp(zFixedCorruptionData, decompressed.data(), decompressed.size()),
10161020
0);
10171021
}
1022+
1023+
TEST(ZlibTest, ZipFilenameCommentSize) {
1024+
// Check that minizip rejects zip member filenames or comments longer than
1025+
// the zip format can represent.
1026+
1027+
base::ScopedTempDir temp_dir;
1028+
ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
1029+
base::FilePath zip_file = temp_dir.GetPath().AppendASCII("crbug1470539.zip");
1030+
1031+
zipFile zf = zipOpen(zip_file.AsUTF8Unsafe().c_str(), APPEND_STATUS_CREATE);
1032+
ASSERT_NE(zf, nullptr);
1033+
1034+
// Adding a member with 2^16 byte filename is okay.
1035+
std::string long_filename(UINT16_MAX, 'a');
1036+
EXPECT_EQ(zipOpenNewFileInZip(zf, long_filename.c_str(), nullptr, nullptr, 0,
1037+
nullptr, 0, nullptr, Z_DEFLATED,
1038+
Z_DEFAULT_COMPRESSION),
1039+
ZIP_OK);
1040+
EXPECT_EQ(zipWriteInFileInZip(zf, "1", 1), ZIP_OK);
1041+
EXPECT_EQ(zipCloseFileInZip(zf), ZIP_OK);
1042+
1043+
// Adding a member with 2^16+1 byte filename is NOT okay.
1044+
std::string too_long_filename = long_filename + 'a';
1045+
EXPECT_EQ(zipOpenNewFileInZip(zf, too_long_filename.c_str(), nullptr, nullptr,
1046+
0, nullptr, 0, nullptr, Z_DEFLATED,
1047+
Z_DEFAULT_COMPRESSION),
1048+
ZIP_PARAMERROR);
1049+
1050+
// Adding a member with 2^16 byte comment is okay.
1051+
std::string long_comment(UINT16_MAX, 'x');
1052+
EXPECT_EQ(zipOpenNewFileInZip(zf, "x", nullptr, nullptr, 0, nullptr, 0,
1053+
long_comment.c_str(), Z_DEFLATED,
1054+
Z_DEFAULT_COMPRESSION),
1055+
ZIP_OK);
1056+
EXPECT_EQ(zipCloseFileInZip(zf), ZIP_OK);
1057+
1058+
// Adding a member with 2^16+1 byte comment is NOT okay.
1059+
std::string too_long_comment = long_comment + 'x';
1060+
EXPECT_EQ(zipOpenNewFileInZip(zf, "x", nullptr, nullptr, 0, nullptr, 0,
1061+
too_long_comment.c_str(), Z_DEFLATED,
1062+
Z_DEFAULT_COMPRESSION),
1063+
ZIP_PARAMERROR);
1064+
1065+
EXPECT_EQ(zipClose(zf, nullptr), ZIP_OK);
1066+
1067+
// Check that the long filename and comment members were successfully added.
1068+
unzFile uzf = unzOpen(zip_file.AsUTF8Unsafe().c_str());
1069+
ASSERT_NE(uzf, nullptr);
1070+
char buf[UINT16_MAX + 2];
1071+
1072+
ASSERT_EQ(unzGoToFirstFile(uzf), UNZ_OK);
1073+
ASSERT_EQ(unzGetCurrentFileInfo(uzf, nullptr, buf, sizeof(buf), nullptr, 0,
1074+
nullptr, 0),
1075+
UNZ_OK);
1076+
EXPECT_EQ(std::string(buf), long_filename);
1077+
1078+
ASSERT_EQ(unzGoToNextFile(uzf), UNZ_OK);
1079+
ASSERT_EQ(unzGetCurrentFileInfo(uzf, nullptr, nullptr, 0, nullptr, 0, buf,
1080+
sizeof(buf)),
1081+
UNZ_OK);
1082+
EXPECT_EQ(std::string(buf), long_comment);
1083+
1084+
EXPECT_EQ(unzGoToNextFile(uzf), UNZ_END_OF_LIST_OF_FILE);
1085+
EXPECT_EQ(unzClose(uzf), UNZ_OK);
1086+
}
1087+
1088+
TEST(ZlibTest, ZipExtraFieldSize) {
1089+
// Check that minizip rejects zip members with too large extra fields.
1090+
1091+
std::string extra_field;
1092+
extra_field.append("\x12\x34"); // Header ID.
1093+
extra_field.append("\xfb\xff"); // Data size (not including the header).
1094+
extra_field.append(UINT16_MAX - 4, 'a');
1095+
1096+
base::ScopedTempDir temp_dir;
1097+
ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
1098+
base::FilePath zip_file = temp_dir.GetPath().AppendASCII("extrafield.zip");
1099+
1100+
zipFile zf = zipOpen(zip_file.AsUTF8Unsafe().c_str(), APPEND_STATUS_CREATE);
1101+
ASSERT_NE(zf, nullptr);
1102+
1103+
// Adding a member with 2^16 byte extra field should work.
1104+
EXPECT_EQ(zipOpenNewFileInZip(zf, "a", nullptr, extra_field.data(),
1105+
extra_field.size(), extra_field.data(),
1106+
extra_field.size(), nullptr, Z_DEFLATED,
1107+
Z_DEFAULT_COMPRESSION),
1108+
ZIP_OK);
1109+
EXPECT_EQ(zipWriteInFileInZip(zf, "1", 1), ZIP_OK);
1110+
EXPECT_EQ(zipCloseFileInZip(zf), ZIP_OK);
1111+
1112+
// More then 2^16 bytes doesn't work. Neither for size_extrafield_local, nor
1113+
// size_extrafield_global.
1114+
std::string extra_field_long = extra_field + 'x';
1115+
EXPECT_EQ(
1116+
zipOpenNewFileInZip(zf, "b", nullptr, nullptr, 0, extra_field_long.data(),
1117+
extra_field_long.size(), nullptr, Z_DEFLATED,
1118+
Z_DEFAULT_COMPRESSION),
1119+
ZIP_PARAMERROR);
1120+
EXPECT_EQ(zipOpenNewFileInZip(zf, "b", nullptr, extra_field_long.data(),
1121+
extra_field_long.size(), nullptr, 0, nullptr,
1122+
Z_DEFLATED, Z_DEFAULT_COMPRESSION),
1123+
ZIP_PARAMERROR);
1124+
1125+
EXPECT_EQ(zipClose(zf, nullptr), ZIP_OK);
1126+
1127+
// Check that the data can be read back.
1128+
unzFile uzf = unzOpen(zip_file.AsUTF8Unsafe().c_str());
1129+
ASSERT_NE(uzf, nullptr);
1130+
char buf[UINT16_MAX + 1] = {0};
1131+
1132+
ASSERT_EQ(unzGoToFirstFile(uzf), UNZ_OK);
1133+
ASSERT_EQ(unzGetCurrentFileInfo(uzf, nullptr, nullptr, 0, buf,
1134+
sizeof(buf) - 1, nullptr, 0),
1135+
UNZ_OK);
1136+
EXPECT_EQ(std::string(buf), extra_field);
1137+
1138+
EXPECT_EQ(unzGoToNextFile(uzf), UNZ_END_OF_LIST_OF_FILE);
1139+
EXPECT_EQ(unzClose(uzf), UNZ_OK);
1140+
}

‎doc/contributing/maintaining/maintaining-dependencies.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ This a list of all the dependencies:
3131
* [undici 5.23.0][]
3232
* [uvwasi 0.0.16][]
3333
* [V8 11.3.244.8][]
34-
* [zlib 1.2.13.1-motley-526382e][]
34+
* [zlib 1.2.13.1-motley-f5fd0ad][]
3535

3636
Any code which meets one or more of these conditions should
3737
be managed as a dependency:
@@ -311,7 +311,7 @@ See [maintaining-web-assembly][] for more informations.
311311
high-performance JavaScript and WebAssembly engine, written in C++.
312312
See [maintaining-V8][] for more informations.
313313

314-
### zlib 1.2.13.1-motley-526382e
314+
### zlib 1.2.13.1-motley-f5fd0ad
315315

316316
The [zlib](https://chromium.googlesource.com/chromium/src/+/refs/heads/main/third_party/zlib)
317317
dependency lossless data-compression library,
@@ -349,4 +349,4 @@ performance improvements not currently available in standard zlib.
349349
[update-openssl-action]: ../../../.github/workflows/update-openssl.yml
350350
[uvwasi 0.0.16]: #uvwasi-0016
351351
[v8 11.3.244.8]: #v8-1132448
352-
[zlib 1.2.13.1-motley-526382e]: #zlib-12131-motley-526382e
352+
[zlib 1.2.13.1-motley-f5fd0ad]: #zlib-12131-motley-f5fd0ad

0 commit comments

Comments
 (0)